{"id":299744,"recorded_at":"2026-10-26T22:17:51.879934Z","observed_at":"2026-10-26T22:17:51.879882Z","subject_kind":"endpoint","subject":"0b394709-2101-47f8-8305-edb21b330ae7","kind":"mcp.tools","method":"probe.mcp/1","body":{"count":15,"tools":[{"description":"HaveIBeenPwned breach database — check domain/company breach exposure. DORA Art. 18 incident assessment.","inputSchema":{"additionalProperties":false,"properties":{"domain":{"description":"Company domain e.g. 'meinbank.de' (optional — omit for latest breaches)","type":"string"},"limit":{"default":20,"description":"Max results 1-50 (default: 20)","maximum":50,"minimum":1,"type":"integer"}},"type":"object"},"name":"breach_check"},{"description":"CERT-Bund security advisories — authoritative DE source for ICT threats. DORA Art. 17 threat monitoring.","inputSchema":{"additionalProperties":false,"properties":{"keyword":{"description":"Filter by keyword e.g. 'Windows', 'Apache', 'Cisco'","type":"string"},"limit":{"default":15,"description":"Max results 1-30 (default: 15)","maximum":30,"minimum":1,"type":"integer"}},"type":"object"},"name":"cert_advisories"},{"description":"Live status of AWS, GCP, Azure cloud providers. DORA Art. 28 third-party ICT risk monitoring.","inputSchema":{"additionalProperties":false,"properties":{"limit":{"default":10,"description":"Max incidents per provider (default: 10)","type":"integer"},"provider":{"description":"Provider: aws, gcp, azure, all (default: all)","type":"string"}},"type":"object"},"name":"cloud_status"},{"description":"Latest critical CVEs — daily DORA ICT risk briefing. Filter by severity and banking relevance.","inputSchema":{"additionalProperties":false,"properties":{"banking_only":{"description":"Filter to banking-relevant vendors only (default: false)","type":"boolean"},"days":{"default":7,"description":"Last N days (default: 7)","type":"integer"},"limit":{"default":10,"description":"Max results 1-20 (default: 10)","maximum":20,"minimum":1,"type":"integer"},"severity":{"description":"CRITICAL, HIGH, MEDIUM (default: CRITICAL)","type":"string"}},"type":"object"},"name":"cve_latest"},{"description":"Search CVEs by keyword, vendor or product. Returns CVSS scores, attack vectors, DORA pillar mapping.","inputSchema":{"additionalProperties":false,"properties":{"days":{"default":30,"description":"Published within last N days (default: 30)","type":"integer"},"keyword":{"description":"Search keyword e.g. 'authentication bypass', 'remote code execution'","type":"string"},"limit":{"default":10,"description":"Max results 1-20 (default: 10)","maximum":20,"minimum":1,"type":"integer"},"severity":{"description":"CVSS severity: CRITICAL, HIGH, MEDIUM, LOW","enum":["CRITICAL","HIGH","MEDIUM","LOW"],"type":"string"},"vendor":{"description":"Vendor/product e.g. 'SAP', 'Cisco', 'Microsoft Exchange'","type":"string"}},"type":"object"},"name":"cve_search"},{"description":"DORA compliance milestones and upcoming deadlines for financial institutions. All Art. references included.","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"},"name":"dora_calendar"},{"description":"EBA/DORA regulatory news for banks. Topics: general, eba, incident, third_party, testing, guidelines, bafin, swift.","inputSchema":{"additionalProperties":false,"properties":{"lang":{"description":"Language: en or de (default: en)","type":"string"},"limit":{"default":10,"description":"Max articles 1-20 (default: 10)","maximum":20,"minimum":1,"type":"integer"},"topic":{"description":"Topic: general, eba, incident, third_party, testing, guidelines, bafin, swift, fintech","type":"string"}},"type":"object"},"name":"dora_news"},{"description":"DORAOracle server status and all backend connectivity checks.","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"},"name":"health_check"},{"description":"Generate a DORA Art. 19-aligned ICT incident reporting timeline with the regulatory deadline structure. Supports - does not constitute - compliant reporting.","inputSchema":{"additionalProperties":false,"properties":{"classification":{"description":"Incident class: major, significant, minor (default: major)","type":"string"},"incident_time":{"description":"ISO timestamp of incident e.g. '2026-03-19T14:00:00Z' (default: now)","type":"string"},"sector":{"description":"Sector: banking, insurance, payment (default: banking)","type":"string"}},"type":"object"},"name":"incident_timeline"},{"description":"Check if a specific CVE is in CISA KEV (actively exploited in the wild). Returns DORA incident classification guidance.","inputSchema":{"additionalProperties":false,"properties":{"cve_id":{"description":"CVE ID to check e.g. 'CVE-2021-44228' (Log4Shell)","type":"string"}},"type":"object"},"name":"kev_check"},{"description":"CISA Known Exploited Vulnerabilities — actively exploited CVEs with patch deadlines. DORA Art. 9 patch compliance.","inputSchema":{"additionalProperties":false,"properties":{"days":{"default":30,"description":"Added to KEV within last N days (default: 30)","type":"integer"},"limit":{"default":15,"description":"Max results 1-50 (default: 15)","maximum":50,"minimum":1,"type":"integer"},"overdue":{"description":"Show only overdue patches (default: false)","type":"boolean"},"vendor":{"description":"Filter by vendor e.g. 'Cisco', 'Microsoft', 'SAP'","type":"string"}},"type":"object"},"name":"kev_list"},{"description":"MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.","inputSchema":{"additionalProperties":false,"properties":{"keyword":{"description":"Search keyword e.g. 'ransomware', 'phishing', 'credential'","type":"string"},"limit":{"default":10,"description":"Max results 1-20 (default: 10)","maximum":20,"minimum":1,"type":"integer"},"tactic":{"description":"Filter by tactic: Initial Access, Lateral Movement, Impact, Persistence, etc.","type":"string"}},"type":"object"},"name":"mitre_techniques"},{"description":"DORA Art. 28 ICT third-party risk assessment: CVE history, news, GLEIF registration, contractual checklist.","inputSchema":{"additionalProperties":false,"properties":{"provider":{"description":"Provider name e.g. 'SAP', 'Salesforce', 'AWS', 'Temenos'","type":"string"}},"type":"object"},"name":"provider_risk"},{"description":"Feodo Tracker: live C2 botnet servers (Emotet, QakBot, etc.). Actionable IP blocklist for DORA Art. 9.","inputSchema":{"additionalProperties":false,"properties":{"limit":{"default":20,"description":"Max results 1-100 (default: 20)","maximum":100,"minimum":1,"type":"integer"},"malware":{"description":"Filter by malware family: Emotet, QakBot, Dridex, TrickBot","type":"string"},"status":{"description":"Filter by status: online, offline","type":"string"}},"type":"object"},"name":"threat_actors"},{"description":"TIBER-EU threat scenarios for DORA resilience testing planning. Banking-specific attack simulations.","inputSchema":{"additionalProperties":false,"properties":{"focus":{"description":"Focus area: swift, ransomware, insider, ddos, cloud (default: all)","type":"string"},"sector":{"description":"Sector: banking (default: banking)","type":"string"}},"type":"object"},"name":"tlpt_scenarios"}]},"body_sha256":"b75ffe43610112f1c2ff67b2cce2dfef337e218dc5bd6e681899973d08cd3a22","prev_id":null,"leaf":"0x8b1f1c3d2604bfdd9109287d3cffb516ab6655f4ff9535007a641627711531a5","leaf_text":"{\"body\":\"b75ffe43610112f1c2ff67b2cce2dfef337e218dc5bd6e681899973d08cd3a22\",\"id\":299744,\"kind\":\"mcp.tools\",\"method\":\"probe.mcp/1\",\"observed_us\":1793053071879882,\"prev\":null,\"subject\":\"0b394709-2101-47f8-8305-edb21b330ae7\",\"subject_kind\":\"endpoint\"}","day":{"day":"2026-10-26","leaves":296695,"root":"0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8","chained":"0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a","anchor_chain":"eip155:5042002","anchor_tx":"0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae","anchor_block":69251483},"proof":["0x8b1f53aff121c2b60f56890962de4cb4dfc9262bc849711dd770003e57a7c915","0xadebf37b523b9e73eeae07a056fa7c05766dd15dfbd024e962cc7d5f6db61f64","0x1f45a892f71cfa19f190311e36662779eb366f58935f4bf0e627549f70e09cf4","0x9b647bc591ef8f3156ad1f2563c39da16b7f204f1a67edc6e7088b913a69f2a4","0x9f52e16dcc6f93943790bdb900750940ba0275abc59f4dd822f9476bd842685b","0xb4d37c809fd704b5dedfa74d84ae289043d3edc0b54aba270a4af12b898ee323","0xb0f5534f081e32471ea221d5d7122461bddc4081420882bb4e0d5694b9458fad","0x29dfc76639bdd608de1da37aa51ef19a82f23e884bfa3bcbc31248d798cddff7","0x0fffe292d9960e31d06d8fce508362f1d4f4450d619eba8241c8efa6d94710d9","0x7d19a8f0d44d0c224dd4e1fd540ac67cd3370e926b73e965b2beb37e5ab9936b","0x7d887da17795602ff54a7a2d145692904e47f8d3ab035b8db85d274d00bc9bfe","0x8cb11bf3bc7d3a6f859c170a167821024ffc4758cdfd2cc96f61a3291aefb637","0xd5ec7ffaecac790d8adfa0620b0a5494758f862e3090b49e556a6ecbad2f0782","0x78ac2b34737774659a6a411f4d10b8ba570d40699d9f277321c3a32ff03d1dc9","0x7eb603d37f0f22dae1ea013e391889906ffc0139ff26e25b044bee38eec8f9b2","0x2b6e23e3624a1b66e1d2298cfbce99a93ce6b13d24a58112a71802d79c5f7a76","0xd21942ae3214eff88e08ab04884fd4b11958b51af9a0741b7668e2d07a2c56c9","0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f","0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a"]}